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SUMMAR Y & CON CL USIONS 

A risk analysis of the launch, orbital assembly, and Earth- 
departure phases of human Mars exploration campaign archi- 
tectures was completed as an extension of a probabilistic risk 
assessment (PRA) originally carried out under the NASA 
Constellation Program Ares V Project [1]. The objective of the 
updated analysis was to study the sensitivity of loss-of- 
campaign risk to such architectural factors as composition of 
the propellant delivery portion of the launch vehicle fleet 
(Ares V heavy-lift launch vehicle vs. smaller/cheaper com- 
mercial launchers) and the degree of launcher or Mars-bound 
spacecraft element sparing. Both a static PRA analysis and a 
dynamic, event-based Monte Carlo simulation were developed 
and used to evaluate the probability of loss of campaign under 
different sparing options. Results showed that with no sparing, 
loss-of-campaign risk is strongly driven by launcher count and 
on-orbit loiter duration, favoring an all-Ares V launch ap- 
proach. Further, the reliability of the all-Ares V architecture 
showed significant improvement with the addition of a single 
spare launcher/payload. Among architectures utilizing a mix 
of Ares V and commercial launchers, those that minimized the 
on-orbit loiter duration of Mars-bound elements were found to 
exceed the reliability of no spare all-Ares V campaign if un- 
limited commercial vehicle sparing was assumed. 

1 INTRODUCTION 

The NASA Mars Design Reference Architecture (DRA) 
Version 5.0 [2] for a human Mars campaign was introduced 
during NASA’s now-cancelled Constellation Program. It envi- 
sioned using a series of Ares V launches to insert three Mars 
transfer vehicles (MTVs), their payloads, crew, and propellant 
into low-Earth orbit (LEO) for multi-year staging periods prior 
to sending the crew to Mars ( Figure 1) and back. Targeting 
160 metric-ton payloads to LEO, the proposed Ares V heavy- 
lift launch vehicle was considered critical to NASA’s deep- 
space exploration efforts. Ares V consisted of two space shut- 
tle heritage solid rocket motors strapped to liquid-hydrogen- 
fueled core and upper stages. The upper stage was dubbed the 
Earth Departure Stage (EDS) for its intended role in sending 
payloads from LEO to other destinations in the solar system. 
In 2010, the Ares V Project conducted an in-depth study of the 


implications of the Mars DRA 5 recommendations on Ares V 
utilization [1], examining only the launch, LEO, and Earth- 
departing trans-Mars-injection (TMI) segments of the cam- 
paign. A broad range of DRA 5 -derived architectures was 
considered, with MTVs driven variously by nuclear thermal 
propulsion (NTP), dedicated cryogenic rocket clusters, or Ares 
V EDS stages. These propulsion selections impacted the num- 
ber of Ares Vs required to lift the MTV elements and 
propellant. Because studies indicate that extensive use of 
commercial launchers in a Mars campaign would help sustain 
a robust commercial vehicle market [2], the Ares V Mars 
study also considered a “Commercial Tanker” architecture in 
which large fleets of smaller capacity commercial launchers 
would carry propellant to assembled MTVs in LEO. 




Figure 1: Campaign overview, near-Earth phase, for the all- 
Ares V “Scavenger” architecture. Propellant deliveries in red. 

Because achieving acceptable estimates of mission reli- 
ability will be a key challenge for initial human missions to 
Mars, the study [1] included a static probabilistic risk assess- 
ment (PRA) of the near-Earth phases of three of the campaign 
architectures. These included two EDS -powered MTV cases — 
one Ares V-only (“Scavenger”) and one Commercial Tanker. 
By far, the risk of loss of campaign was found to be the great- 
est for the Commercial Tanker architecture, because it utilized 
the most launches and forced the MTV elements to loiter in 


LEO for years awaiting propellant deliveries. However, due to 
the limitations of the static PRA approach, the analysis as- 
sumed conservatively that no spare launch vehicles or MTV 
elements were available; any single launch or on-orbit failure 
was assumed to cause the total loss of a campaign. Also, alter- 
native propellant delivery strategies that would reduce the 
LEO loiter exposure of MTV elements, such as the use of pro- 
pellant depots [3], were not considered. 

Despite the discontinuation of the Constellation Program 
and Ares V, a further examination of the reliability of Ares V- 
based Mars campaign architectures is warranted. Based on the 
Space Launch System, NASA’s successor to the Ares V, hu- 
man exploration campaigns to various destinations in the Solar 
System are currently being studied [4]. This paper revisits 
loss-of-campaign risk during the near-Earth phase for two of 
the EDS/MTV-based Ares V Mars campaign architectures 
from [1] and two additional variants. The objective of the 
present study is to understand how the dependence of loss-of- 
campaign risk on launcher fleet composition and propellant 
delivery strategy varies with launcher and spacecraft element 
sparing level. The static PRA approach of [1] was reused to 
establish bounding cases of no spares across all architectures 
and, in Commercial Tanker architectures, unlimited commer- 
cial launch vehicle spares. A dynamic PRA based on a time- 
marching, event-driven Monte Carlo simulation was then de- 
veloped to examine single-launcher sparing options for one of 
the Commercial Tanker architectures. The loiter risk failure 
rate used in both of these analyses was updated to better re- 
flect anticipated subsystem redundancy and MMOD strike 
tolerance among the various spacecraft elements. 

In the following sections, the campaign architectures are 
detailed and the basic campaign risk assumptions are outlined. 
The static and dynamic PRA methodologies are then intro- 
duced. Finally, no-spare, single-spare, and unlimited-spare 
results are compared and discussed for the four architectures. 


Architecture 

Ares V CT Duration 
( launches ) (days) 

MTV Loiter 
(elem.-days) 

CT Loiter 
(tanker-days) 

Scavenger* 

9 

— 

914 

835 

— 

Commercial Tanker (CT) 






Post-MTV * 

4 

36 

1169 

2665 

~0 

Pre-MTV 

4 

36 

1154 

295 

5655 

Prop. Depot 

5 

36 

1184 

295 

900f 


Table 1: Campaign architecture statistics. 

* Architectures originally assessed in [1]. f. Prop. Depot loiter. 


2 MARS CAMPAIGN ARCHITECTURES 

The four EDS/MTV-based architectures considered in the 
present study are listed in Table 1. They share the utilization 
of three MTVs and one crew launch vehicle (CLV), but differ 
in terms of terms of the launch vehicle fleet composition, 
launch/delivery schedule, and the set of on-orbit operations. 
The Scavenger architecture ( Figure 7), carried over from [1], 
relies exclusively on the Ares V to launch uncrewed hardware 
and propellant to LEO. The three Commercial Tanker archi- 
tectures, of which the “Post-MTV” variant also originates 


from [1], use Ares V to deliver MTV spacecraft elements and 
then rely on fleets of 20-metric-ton-payload-class commercial 
launch vehicles to deliver MTV propellant. MTV1 and MTV2 
each use a single EDS to depart LEO through an initial TMI 
window on a nine-month, minimum- energy trajectory to Mars. 
The crewed MTV3 departs using two EDS units through a 
second TMI window approximately 26 months later, on a 6- 
month trajectory. 

Details of all the architectures are provided in the follow- 
ing sections, with a summary of launch count, campaign 
duration, and LEO loiter characteristics given in Table 1 and 
campaign schedules given in Figure 2. 
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Figure 2: Campaign schedules. 


2.1 Scavenger 


The Scavenger architecture ( Figure 1) utilizes nine Ares 
V launches and one CLV crew launch. MTV1 and MTV2 each 
receive their hardware and EDS propulsion element from the 
first two Ares Vs, followed by two-thirds of their propellant 
from the third and fourth Ares Vs. The fifth Ares V then sup- 
plies the remaining propellant to both MTVs in succession. 
MTV3 receives its payload and EDS propulsion elements 
from the sixth and seventh Ares Vs, with propellant following 
in the eighth and ninth launches. The CLV launch supplies the 
Earth reentry vehicle and crew. 


2.2 Commercial Tanker Variants 


The Commercial Tanker concept replaces the five propel- 
lant-delivery Ares Vs with a fleet of much smaller but cheaper 
commercial heavy-lift launchers. Four Ares Vs are retained to 
lift the non-propellant and EDS propulsion elements. If the 
commercial tanker is the Delta IV Heavy, 36 are needed: 11 
each for MTV1 and MTV2, and 14 for MTV3. The use of 
commercial tankers will offset Ares V propellant launch and 
delivery risk, but the overall campaign risk will also depend 
on the details of tanker use and the tolerance for tanker loss. 

Three variants on the Commercial Tanker concept are 
considered. These differ in terms of the strategy by which the 
propellant is stored in orbit and transferred to the MTVs and, 
as a consequence, where LEO loiter exposure risk is carried 
( Table 1). The Post-MTV variant assumes the MTV hardware 


is delivered to orbit by an Ares V before the commercial tank- 
ers are launched (Figure 2). In this scenario, MTV elements 
can each loiter for up to 375 days in orbit without tankers ac- 
cumulating any loiter time. The “Pre-MTV” variant assumes 
the commercial tankers are launched first and then wait in 
orbit for the MTV propellant deliveries to arrive — exchanging 
MTV loiter time for tanker loiter time. (The details of tanker 
conjunction or formation flying in LEO are not considered 
here.) The “Propellant Depot” variant assumes an additional 
Ares V that initially delivers a permanent propellant storage 
vehicle to LEO, which can store propellant over an indefinite 
period. The advantage of the propellant depot is its reusability 
across campaigns and its increased robustness against LEO 
loiter hazards of propellant loss, component failure, and mi- 
cro-meteorite and orbital debris (MMOD) strike, compared 
with mass-constrained, Mars-bound elements [3]. 

3 RISK ASSESSMENT ASSUMPTIONS AND APPROACH 

Both the static and dynamic PRAs utilized in this study 
are based on a common set of assumptions and the same de- 
mand-based and duration-based failure probability building 
blocks. The static PRA approach relies solely on a logic-based 
framework to consolidate the campaign risk. The dynamic 
approach extends the static PRA risk units with simulation to 
capture interactive effects among events, permitting sparing to 
be modeled. In this section, the ground rules assumed in the 
Ares V Mars campaign risk assessment are delineated, the 
methods by which risk blocks are obtained are described, and 
details of the static and dynamic PRA models are provided. 

3. 1 Ground Rules and Assumptions 

The assessment of loss-of-campaign risk is built around 
the loss of functionality of individual spacecraft elements — the 
launch vehicles, MTV payloads, and propellant delivery or 
storage vessels. Every launch vehicle is tracked, in terms of its 
launch and subsequent payload-element operations, to include 
launch risks, delivery risks (on-orbit maneuvers, deployments, 
dockings/assemblies, etc.), loiter risks, and the TMI burn. The 
following assumptions were adopted: 

1) Ares V and commercial tanker loss-of-vehicle risks per 
launch are fixed over the campaign. 

2) On-orbit loiter carries duration-based risk per in-space 
element, based on days of LEO exposure. 

3) The launch spacings are 30 days for Ares Vs, 15 days 
for commercial tankers, and 1 day for the CLV. 

4) There is a 14-day checkout period after MTV assembly 
and before TMI. 

5) All launches supplying a given MTV are scheduled 
ahead of its TMI window (Figure 2). 

6) Propellant capacities are 18.5 metric tons for the com- 
mercial tanker (Delta IV Heavy), 201 tons each for 
MTV1 and MTV2, and 250 tons for MTV3. 

3.2 Demand-based Risks 

Failures probabilities during launch, delivery, and TMI 


propulsion system burn segments were modeled as demand 
risks and remained unchanged from [1]. Crew launch vehicle 
(CLV) risks were based on Constellation risk assessments for 
Ares I, which utilized physics-based, simulation-assisted risk 
assessment techniques [3]. Ares V ascent failure probability 
was adapted from Ares I risk assessments. Commercial 
launcher failure risk was based on heritage data [6] . Delivery 
risks stemmed from complex, temporally sensitive mission 
operations such as rendezvous and docking, on-orbit fuel 
transfer, and solar array deployments, and are also heritage- 
based. For MTV engine TMI burn utilizing the EDS J-2X en- 
gine, failure risk was based on the restart burn failure rates 
assumed in an Ares V lunar sortie [1]. 

3.3 Element LEO Loiter Risk Assessment 

Duration-based LEO loiter risk was comprehensively up- 
dated in the present study to better model the differences in 
exposure tolerance among in-space elements, according to 
their function and utilization. A preliminary top-down risk 
assessment based upon a previous study [7] and the historical 
record [8] of known risks to orbital vehicles in LEO identified 
two broad classes of risk contributors: subsystem reliability 
and MMOD. In order to ensure accurate relative risk results 
between the existing and proposed architectures considered in 
this study, an independent bottom-up probabilistic risk as- 
sessment (PRA) was performed to obtain quantitative risk 
estimates for LEO loiter risk originating from subsystem unre- 
liability. The risk of MMOD was based upon particle flux 
models, element size, and vulnerability. 

For each of the architectures, the mission elements were 
decomposed into the subsystems required to fulfill the func- 
tional mission requirements. Surrogate estimates for each class 
of subsystem were produced and used as “building blocks” to 
be applied to all elements requiring that subsystem. These 
subsystem “building-blocks” were produced by examining an 
existing detailed PRA of a similar vehicle [9] and proposed 
future vehicle designs [11] to create a generic subsystem mas- 
ter equipment list (MEL). The risk of failure stemming from 
the unreliability of subsystem components was estimated by 
assuming an exponential failure model for each MEL compo- 
nent, utilizing surrogate failure rates from the Space Shuttle 
(SS) PRA 3.0 [7], the International Space Station (ISS) Mod- 
eling and Analysis Data Set, and the Valador Failure Data 
Handbook [8]. The subsystem reliability model [10] took into 
account component redundancy and assumed a different 
“baseline” level of redundancy for each element. 

The risk of MMOD was calculated for each element 
based upon the flux of particles at the particular altitude and 
inclination in LEO, the total surface area of the element, the 
assumed MMOD damage tolerance of the element, and the 
time each element spent in LEO. The flux of OD was deter- 
mined by using ORDEM2000 [12] for a 400-km circular orbit 
at 28.5 degrees of inclination [1], and the flux of MM was 
determined by the predictions of the NASA MMOD handbook 
[13] for the same orbit. Estimates for the total surface area of 
each element were produced from literature or by assuming 


the worst-case size of the Ares V shroud [1]. Assumptions 
were made about the damage tolerance of each element that 
corresponded to previously designed space vehicles such as 
Apollo, Soyuz, Shuttle, and ISS [14]. 

3. 4 Static Probabilistic Risk Assessment 

The static PRA is a logic-based fault-tree analysis in 
which the risk elements described in the previous section were 
consolidated at the subsystem and spacecraft-element levels, 
accounting for operational demand counts and element expo- 
sure durations in LEO. Subsystem redundancy levels were 
adjusted to balance risk tolerance and mass limitations, lead- 
ing to low subsystem redundancy in commercial tanker 
vehicles, high redundancy in the propellant depot, and inter- 
mediate levels for most other elements. 



Figure 3: Risk Simulation Algorithm 


3. 5 Dynamic Probabilistic Risk Assessment 

To allow the dynamic effects of vehicle sparing on cam- 
paign risk to be examined, a continuous-time Monte Carlo risk 
simulation model consisting of transportation and orbital ele- 
ments was developed for this study. This model was based on 
a model originally generated for the NASA Lunar Surface 
Systems study [15], which also incorporated an Ares V deliv- 
ery system. While the demand-based failure probabilities and 
exposure-based failure rates are identical to those used in the 
static PRA model, the interaction among events and the time 
delays modeled in the simulation result in a more complex set 
of outcomes. The simulation model accounts for payload re- 
flights if there is a failure during launch or delivery and tracks 
the risk consequences that propagate to other elements. The 
simulation algorithm is depicted in Figure 3. 

Each Monte Carlo realization of a campaign starts with 
the launch event of the first mission. If the launch is success- 
ful, the payload of the mission is activated and exposure time 
starts accruing. If the launch fails, a refly of the mission with a 
specified delay can be simulated, based on the availability of 
redundancy for flight and payload elements. After the delivery 
of all the MTV elements, given no orbital failure, there is a 


TMI Earth-departure activity. A simulation run is considered 
successful if all of the necessary elements are delivered suc- 
cessfully to orbit and there is no on-orbit element failure. 
Missed TMI windows were not recorded as failures. 

In these simulations, a spare was assumed to be flown 
only in response to launch or delivery failures. Loiter and TMI 
failures were not considered triggers for reflight, due to the 
modeling complexity introduced by the docking and undock- 
ing procedures that would be required to replace failed 
elements during these phases. Failure probability was taken as 
the ratio of failed realization count to total realization count. 

Probability of Loss of Campaign 
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Figure 4: Loss-of-campaign probability by mission phase, 
based on Static PRA (no sparing) 

4 RISK ASSESSMENT RESULTS 

The results presented in this section cover baseline, no- 
spare risk assessment results for all four architectures; single- 
launch vehicle sparing results for the Scavenger architecture; 
and unlimited sparing risk estimates for the three Commercial 
Tanker architectures. 

The no-spare loss-of-campaign risk results of all four ar- 
chitectures are shown in Figure 4. These results were obtained 
using the static PRA. Contributions to campaign risk are cate- 
gorized by mission phase and launch vehicle type. For both 
Scavenger and Commercial Tanker architectures, launch and 
delivery risks were driving factors in determining overall risk. 
It follows, then, as was observed in [1], that overall Commer- 
cial Tanker risk far exceeds overall Scavenger risk due 
primarily to the large commercial launcher count. Among the 
Commercial Tanker architectures, loiter risk is the discrimi- 
nating factor. The Pre-MTV variant carries the most campaign 
risk due to its reliance on prepositioning the tanker fleet in 
LEO. The tankers launched early must wait in orbit through 
the numerous remaining launches before delivering propellant 
to MTVs. However, in exchange, Pre-MTV also minimizes 
MTV element loiter. Conversely, the Post-MTV variant im- 
poses the most loiter time of any of the architectures on the 
MTV elements and the least on the tankers. Due to its use of a 
dedicated storage platform in LEO, the Propellant Depot vari- 
ant minimizes both MTV element and tanker loiter. 
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A set of launch vehicle sparing cases within a single cam- 
paign architecture was studied, requiring the use of the 
dynamic PRA Monte Carlo simulation. The architecture se- 
lected was the all-Ares V Scavenger campaign, with the 
sparing level limited to one reflown Ares V or CLV. To ad- 
dress the possibility that some payloads would be one-of-a- 
kind, and not sparable, a partial sparing case was also added. 
The three simulation cases were: 

1) No Spare : No launcher/payload redundancy. 

2) Partial Spare : One spare Ares V to refly only one 
spare EDS for TMI and/or propellant payload. 

3) All Spare : One spare Ares V or CLV, to refly any 
payload once. 

Probability of Loss of Campaign 
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Figure 5: Scavenger simulation-based results. 
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Figure 6: Scavenger simulation-based results, loiter phase. 

Each simulation was run for 100,000 Monte Carlo realiza- 
tions. The probabilities of loss-of-campaign for the three 
simulations are shown in Figure 5, and are compared to the 
static PRA No Spare case. The simulation-based result for the 
No Spare option agrees with the static PRA result, validating 
the simulation approach. Having one spare Ares V with an 
ED S/propellant payload reduces the probability of overall loss 
of campaign by a third, and reduces the chance of campaign 
loss during launch and delivery by half, since five of ten 
flights can be reflown. Allowing the spare Ares V or CLV to 
refly any payload (the “All Spare ” option) reduces overall risk 
by two-thirds and nearly eliminates loss-of-campaign risk dur- 
ing launch and delivery. While spare campaign spacecraft 
elements come at a significant program cost, the advantage in 
terms of campaign reliability is clear. 

An increase in LEO loiter risk was observed with increas- 
ing sparing in the Scavenger architecture ( Figure 6). These 
Scavenger sparing simulations registered different failure 
probabilities during the LEO loiter phase as a result of the 
dynamic interaction among simulation elements. The varia- 
tions that arise are due to two effects: 


1) Reduction in launch and delivery failures increases 
the number of realizations in which the loiter phase is 
exercised, resulting in increased observed loiter risk. 

2) Reflights (no more than one per realization) extend 
the overall loiter exposure of other in-space elements 
by the delay caused by the reflight. 

Without spares, any launch failure ends the campaign and all 
in-orbit elements are discarded. With spares, in-orbit elements 
continue to be tracked until either a second failure ends the 
campaign or the realization ends successfully. These effects 
are small due to the relatively short exposure to LEO loiter 
experienced in the Scavenger architecture. 
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Figure 7: Overall loss-of-campaign probability based on 
Static PRA, assuming unlimited commercial tanker spares. 


A comprehensive sparing study was not carried out on the 
Commercial Tanker architectures in the present work. In a 
robust market of commercial launch vehicles, an essentially 
unlimited supply of tanker spares may be possible to help as- 
sure the success of a human Mars campaign. To estimate 
where deep tanker sparing might lead, the no-spare Commer- 
cial Tanker risk results ( Figure 4) were adjusted by zeroing 
the direct tanker launch, delivery, and loiter contributions to 
campaign risk. These results are shown in Figure 7. In this 
limit, the Pre-MTV and Propellant Depot variants are shown 
to exceed even the reliability of the No Spare and Partial Spare 
(single spare) results for the Scavenger architecture. The Pre- 
MTV variant, which shows the most risk among all the archi- 
tectures in the no-spare scenario, shows the least risk in the 
unlimited spare limit due to its lack of MTV element loiter. In 
reality, launcher reflights will not be unlimited, and they will 
cause delays in the schedule that might increase both loiter 
risk for waiting elements and the risk of a missed TMI win- 
dow. 


5 CONCLUSIONS AND FUTURE WORK 

This study presents a risk assessment of the near-Earth 
launch and orbital operations activity of a conceptual human 
campaign to Mars involving heavy-lift and commercial launch 
vehicles. The goals of the study were: 1) to determine the risk 
trade-offs of utilizing commercial launch vehicles as propel- 
lant tankers instead of the much larger Ares V, 2) to 
understand the risk benefits of launch vehicle and spacecraft 
element sparing, and 3) to determine the risk sensitivity to 
commercial tanker propellant delivery strategy. One Ares V- 
only architecture and three combined Ares V/commercial 
launcher architectures were assessed using both logic-based 






PRA and event-based Monte Carlo simulation techniques. 
When no sparing was assumed, the loss-of-campaign risk 
borne by Commercial Tanker architectures was found to far 
exceed the Ares V-only Scavenger architecture due to the 
large number of commercial launches and the resulting loiter 
time imposed on elements waiting in orbit. The Monte Carlo 
simulation findings, which allow for partial or complete 
launcher and payload single-fault redundancy, clearly indicate 
that even a modest reflight capability of the Ares V will 
greatly increase the likelihood of success of a Mars campaign. 
In the special case of unlimited commercial tanker sparing, the 
potential hypothetical reliability of architectures that launch 
propellant prior to Mars-bound elements was found to exceed 
that of the no-spare Scavenger case, with the Pre-MTV tanker 
variant edging out the Propellant Depot approach. 

In future work, the Monte Carlo simulations will be ex- 
tended to the remaining architectures to more clearly 
demonstrate the dynamic interaction between launcher redun- 
dancies and loiter exposure risk. The relative risk-reduction 
potential among the three Commercial Tanker variants can 
also be further examined. In addition, future studies will test 
the hypothesis that given enough spare launchers, the near- 
Earth phase campaign reliability of the Commercial Tanker 
architectures can surpass the Scavenger architecture reliability. 
Finally, other dynamic effects such as missing launch win- 
dows and reliability maturity growth will be studied. 
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Mars Campaign Risk Analysis Overview 


♦ Objective: 

• Compare risk of Ares V vs. commercial launchers as propellant delivery vehicles 

• Understand risk benefits of launcher/element sparing 

♦ Update to: 

• Ares V Mars campaign study risk assessment 

- Holladay, et al., “Ares V Utilization in Support of Human Mission to Mars,” NASA TM 2010-216450. 
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Campaign Architecture 
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Commercial Tanker Architectures 
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Near-Earth Mission Phases 
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Ground Rules and Assumptions 


4 Loss of Campaign occurs when 

• No Spare: any single failure occurs 

• Single Spare: failure occurs during launch or delivery phases, followed by another failure 

4 Demand risks regularized 

• Independent of vehicle type, except launch risk 

4 LEO Loiter risk is duration-based by element 

• Duration is based on the accumulated orbital time from launch gaps 

4 Gaps between launches 

• Ares V: 30 days 

• Commercial Tanker: 15 days 

• CLV: 1 day 

♦ MTV checkout 

• Loiter for >14-days after assembly, MTV1 & MTV2 depart Earth together 

4 26-month (780 day) gap between Earth departure windows to Mars 
4 Propellant capacity: 

• Commercial tanker: 18.5 metric tons (based on Delta IV Heavy) 

• MTV1 & 2: 201 ton each 

• MTV3: 250 ton 
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Risk Elements 


♦ Demand Risks 

• Launch and Earth Departure 

- Ares V, CLV - Simulation assisted risk assessment (based on Ares I) 

- MTV NTP - RL- 10 reference (Centaur) 

- MTV Chemical - J2-X reference (Ares I) 

• Deployments and Docking 

♦ Exposure Risks 

•Micrometeorite and orbital debris (MMOD) strike - (ORDEM) 
•Subsystem reliability - selectable redundancy - (Shuttle, ISS, etc.) 

MTVI’s Mars Cargo Element (Subystem failure rates / redundancy level) 
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Subsystem 

+ FT = 0 

+ FT = 1 

+ FT = 2 

+ FT = 3 

Active 

Passive 



RCS 

6.07E-06 

3.03E-08 

3.13E-09 

1.79E-09 

1 

1 



Comm 

9.08E-06 

2.12E-06 

1.22E-06 

1.22E-06 

1 

1 



TCS 

1.23E-05 

1.73E-06 

9.29E-07 

9. 13E-07 

1 

1 



Avionics 

5.52E-06 

1.77E-06 

1.36E-06 

1.36E-06 

1 

1 



Prop Management 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

1 

1 



Power 

1. 12E-05 

2.59E-06 

1.48E-06 

1.48E-06 

1 

1 

Redundancy Set 


ECLSS - Active 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

1 

0 

1. Low 2. Inter 

3. High 

ECLSS - Passive 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

0 

1 

+ FT +FT 

+ FT 

MlilOD 

1.77E-05 

1.77E-05 

1.77E-05 

1.77E-05 

1 

1 

0 1 

3 

Active Total 

6.19E-05 

2.60E-05 

2.27E-05 

2.27E-05 


6.19E-05 2.60E-05 

2.27E-05 


9 



Static Probabilistic Risk Assessment 


Campaign Architecture 
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Results: No Spares (All Architectures) 


Static PRA 
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Results: Single Spare - Scavenger 


Dynamic PRA 

• Monte Carlo Realizations: 

• 100,000 per simulation 

• Sparing Limit 

• Maximum of 1 per realization 


Launcher/Element Sparing Categories 
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Results: Unlimited Spares - Commercial Tanker 


Static PRA Result 

♦ Robust commercial launcher market = unlimited spare tankers 

♦ Remove Commercial Tanker failure contribution from No Spare result 

Probability of Loss of Campaign 

0% 2% 4% 6% 8% 10% 12% 14% 16% 18% 

i i i i i i i i i 



15.8% 


Scavenger No Spare 
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Summary and Conclusions 


♦ Ares V Human Mars Campaign Near-Earth phase risk assessment 

•Ares V or Ares V + Commercial Launchers 
•Sparing Levels 

♦ Results summary 

• No Spare 

- Element level failures are driven by launch numbers and LEO loiter duration 

- Favors Ares V-only fleet architectures over Commercial Tanker architectures 


•Single Spare (All-Ares V “Scavenger” Case) 

- One spare Ares V significantly reduces campaign risk 

- Even partial sparing shows benefit 

•Unlimited Spare (Commercial Tanker) 

- Mixed Ares V / Commercial can be better than Ares V only 

- Prepositioning propellant before MTV elements can be better 

♦ Recommendations: Plan for failures. Prepare spare elements. 
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Future Work 


♦ Dynamic Simulation 

• Extend to commercial tanker options 

- Can Commercial Tanker variants can compete with Ares V-only architectures? 

- Which Commercial Tanker variant is best? 

- What level of sparing is needed? A/-failure tolerance. 

- What is the interactive effect of reflight delays on loiter risk exposure? 

• Include schedule impact of reflights, missed launch windows 
•Add maturity growth effects to reliability elements 

♦ Extend assessment to entire Mars campaign 

• Long-duration transit to Mars and back to Earth 

• Mars surface systems 

• Entry, descent, and landing on Mars and back on Earth 
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